Privacy Policy | TSR-ELSITE Oy

Last updated: 15 September 2026

1. General

This privacy notice explains how TSR-ELSITE Oy processes personal data on its website and in its business. The notice has been prepared in accordance with Articles 12–14 of the General Data Protection Regulation (EU) 2016/679 (hereinafter the GDPR). It also explains how we use cookies and similar technologies in accordance with the cookie rules of Finland, Germany and Sweden.

This notice applies to the following groups of people:

visitors to our website
contact persons of our customers and prospective customers
persons in positions of responsibility at customer companies, such as the managing director, members of the board and partners, in connection with credit checks
contact persons of our suppliers and partners
followers of, and visitors to, our company pages on social media

A separate privacy notice is provided to our employees and job applicants.

2. Data controller and Data Protection Officer

Data controller
TSR-ELSITE Oy
Business ID 2135071-2
Orikedonkatu 17, 20380 Turku, Finland
Telephone +358 9 4555 588

Data Protection Officer
Jarno Salonen
Email: jarno.salonen@tsr-elsite.fi
Postal address: TSR-ELSITE Oy, Data Protection Officer, Orikedonkatu 17, 20380 Turku, Finland

You can send questions and requests concerning data protection, such as a request to access or erase your data, by post to TSR-ELSITE Oy, Orikedonkatu 17, 20380 Turku, Finland, or by email to our Data Protection Officer. Exercising your rights is explained in more detail in Section 9.

3. Processing activities, purposes and legal bases

For each processing activity below, we explain what data we process, for what purpose and on which legal basis under the GDPR, how long we keep the data and who receives it or processes it on our behalf. Where processing is based on our legitimate interest (Article 6(1)(f) GDPR), you have the right to object to it as explained in Section 10. The use of cookies and similar technologies is explained in Section 4.

3.1 Use of the website and information security

When you visit our website, your browser sends technical information to our server so that the page can be displayed to you. Our website runs on an UpCloud server in Helsinki. To protect the website, we use the Wordfence Security service, which protects the website with measures such as a firewall and login protection and processes IP addresses for this purpose.

Data: IP address, browser and device information, the page requested, the referring page, a timestamp and information relating to security events, such as details of blocked requests.
Purpose: technical delivery of the website, investigation of malfunctions, ensuring information security, and preventing attacks and misuse.
Legal basis: our legitimate interest in providing a functioning and secure website (Article 6(1)(f)).
Retention period: server and security logs are kept only for as long as necessary to ensure information security and to investigate any misuse, after which they are deleted.
Recipients: UpCloud Oy (Finland) as the server hosting provider, and Defiant, Inc. (Wordfence, United States), to whose cloud-based security network IP addresses may be transmitted.

3.2 Quote request basket

You can add products you are interested in to the quote request basket on our website and send us a request for a quotation. The only mandatory information is your email address. Your name, company, telephone number and message are optional, but they help us prepare a suitable quotation for you more quickly.

Data: email address, the name, company, telephone number and message you provide, the products you add to the basket and the time the quote request was sent.
Purpose: handling the quote request, preparing the quotation, sending a confirmation message, communicating with you about the quotation and monitoring sales.
Legal basis: where you act on behalf of a company or other organisation, our legitimate interest in handling quote requests and managing customer relationships (Article 6(1)(f)). Where you request a quotation in your own name, processing is based on steps taken at your request prior to entering into a contract (Article 6(1)(b)).
Retention period: for as long as necessary to handle the quote request and manage any customer relationship arising from it. After that, the data is deleted or anonymised. If the quotation results in a sale, data forming part of the accounting records is kept as described in Section 3.4.
Recipients: Microsoft Ireland Operations Limited (Microsoft 365, Ireland), whose email service is used to forward the quote request to our sales team and to send the confirmation message from noreply@tsr-elsite.fi; Pipedrive OÜ (Estonia), to whose customer relationship management system the quote request details are transferred; Lemonsoft Oyj (Finland), when the quotation or customer relationship is recorded in our enterprise resource planning system; UpCloud Oy (Finland).

3.3 Enquiries, email and chat

You can contact us by email, by telephone or through the chat on our website. The chat service, which comprises the chat, a chatbot and contact forms completed in the chat, is provided by Serviceform Oy. The chat loads on the website only after you have accepted analytics cookies. The chat service provider may change, in which case we will update this notice.

Data: name, email address, telephone number, company, the content of messages and chat conversations, the time of contact and technical identifiers of the chat service.
Purpose: answering questions, handling contact requests, customer service and sales.
Legal basis: our legitimate interest in responding to enquiries and managing customer relationships (Article 6(1)(f)). If you contact us in your own name regarding a quotation or order, processing is based on steps taken prior to entering into a contract (Article 6(1)(b)). Loading the chat service in your browser is based on your consent (Section 4).
Retention period: for as long as necessary to handle the enquiry and manage the related customer relationship. After that, the data is deleted or anonymised.
Recipients: Serviceform Oy (Finland), Microsoft Ireland Operations Limited (Microsoft 365, Ireland) and, where necessary, Pipedrive OÜ (Estonia) and Lemonsoft Oyj (Finland).

3.4 Customer relationship and contract management, and invoicing

Data: names and contact details (email, telephone) of the customer company and its contact persons, quotation, order, delivery and invoicing details, and notes and messages relating to the customer relationship.
Purpose: handling quotations, orders and deliveries, performing contractual obligations, invoicing, customer communications, and complying with accounting and other statutory obligations.
Legal basis: performance of a contract where you are yourself a party to the contract (Article 6(1)(b)); our legitimate interest in managing the customer relationship with the contact persons of business customers (Article 6(1)(f)); a legal obligation, in particular under the Accounting Act (kirjanpitolaki, 1336/1997) (Article 6(1)(c)).
Retention period: for the duration of the customer relationship and thereafter for as long as the data is needed to meet contractual obligations and deal with any claims. Accounting records are kept in accordance with Chapter 2, section 10 of the Accounting Act (1336/1997): financial statements and books of account for at least 10 years from the end of the financial year, and vouchers and correspondence concerning business transactions for at least 6 years from the end of the year in which the financial year ended.
Recipients: Lemonsoft Oyj (Finland), Pipedrive OÜ (Estonia), Microsoft Ireland Operations Limited (Microsoft 365, Ireland) and public authorities where required by law.

3.5 Credit checks

We may check the credit information of a business customer, for example before granting invoicing or payment terms.

Data: the company’s credit information and, within the limits permitted by the Credit Information Act (luottotietolaki, 527/2007), the credit information of the company’s persons in positions of responsibility, such as the managing director, members of the board and partners.
Purpose: assessing the ability of the company and its persons in positions of responsibility to meet their commitments.
Legal basis: our legitimate interest in managing credit risk (Article 6(1)(f)), within the limits laid down in section 19, subsection 2, paragraph 9 and sections 26 and 27 of the Credit Information Act (527/2007).
Retention period: for as long as the data is needed to make the credit decision and manage the customer relationship.
Source of data and recipients: the data is obtained from the registers of credit reference agencies. The credit reference agency is informed of our enquiry, and a natural person has the right to be informed by the credit reference agency of the parties to whom their credit information has been disclosed during the past year. If credit information leads to a negative decision, we will inform you of this and of the source of information used.

3.6 Marketing and new customer acquisition (B2B)

We market our products and services to companies and other organisations. For making contact, we may also use contact person details of companies obtained from public sources, such as business registers, the media and company websites.

Data: name, company, job title, work email address and work telephone number, information about marketing messages sent and contacts made, and marketing opt-outs and consents.
Purpose: marketing aimed at business customers, informing about products and events, new customer acquisition and sales contacts.
Legal basis: our legitimate interest in marketing our products to companies (Article 6(1)(f)). In Finland, electronic direct marketing may be sent to legal entities and to individuals’ work email addresses without prior consent where the message relates to the recipient’s duties, in accordance with section 202 of the Act on Electronic Communications Services (laki sähköisen viestinnän palveluista, 917/2014), and recipients can opt out of such marketing at any time. We send electronic direct marketing to natural persons acting in a private capacity only with their prior consent (section 200; Article 6(1)(a)). We send email marketing to Germany only with the recipient’s prior consent (§ 7 UWG). We do not currently send newsletters to recipients in Germany.
Retention period: until you object to the processing or withdraw your consent, or until the data is no longer up to date or needed for marketing. Information about a marketing opt-out is kept so that we can comply with it.
Recipients: our email marketing service provider, Pipedrive OÜ (Estonia), Lemonsoft Oyj (Finland) and Microsoft Ireland Operations Limited (Microsoft 365, Ireland).

Every marketing email contains a link that allows you to opt out of marketing easily and free of charge. You can also notify our Data Protection Officer of your opt-out.

If we have obtained your data from a source other than you, we will tell you where it was obtained at the latest when we first contact you. At the same time, we will refer you to this notice and inform you of your right to object to the processing of your data for direct marketing purposes (Section 10).

3.7 Supplier and partner relationships

Data: the name, company and contact details of the supplier’s or partner’s contact person, order, delivery and invoicing details, and communications relating to the cooperation.
Purpose: making purchases, managing contracts and cooperation, processing invoices and bookkeeping.
Legal basis: our legitimate interest in managing supplier and partner relationships (Article 6(1)(f)), performance of a contract where you are yourself a party to the contract (Article 6(1)(b)), and a legal obligation under the Accounting Act (Article 6(1)(c)).
Retention period: for the duration of the cooperation and thereafter for as long as the data is needed to meet contractual obligations. Accounting records are kept as described in Section 3.4.
Recipients: Lemonsoft Oyj (Finland) and Microsoft Ireland Operations Limited (Microsoft 365, Ireland).

3.8 Website search

The search function on our website is provided by Algolia. When you search, your browser sends the search terms directly to Algolia’s servers so that the search results can be displayed. We do not use Algolia’s search behaviour analytics feature (Algolia Insights).

Data: search terms, IP address, browser information and other technical details of the search request.
Purpose: displaying search results and technical maintenance of the search function.
Legal basis: our legitimate interest in providing a functioning search function (Article 6(1)(f)).
Retention period: under the service’s default settings, Algolia keeps search request logs for 90 days, after which they are deleted.
Recipients: Algolia SAS (France) and its sub-processors, some of which operate outside the EU and EEA (Section 7). More information: Algolia’s privacy policy.

3.9 Company pages on social media

We have company pages on Facebook, Instagram, YouTube and LinkedIn. When you follow our pages or interact with us on them, we process your data within the service in question.

Data: your public profile information, comments, reactions, shares and messages you send us, and aggregated statistics about the use of our pages produced by the service.
Purpose: communication, marketing, interaction with followers and developing the pages with the help of statistics.
Legal basis: our legitimate interest in communicating and marketing on social media (Article 6(1)(f)).
Retention period: comments and messages published on our pages remain in the service until you, we or the service provider delete them. Data is stored in our own systems only where necessary, for example to handle an enquiry.
Recipients: Meta Platforms Ireland Limited (Facebook and Instagram, Ireland), LinkedIn Ireland Unlimited Company (Ireland) and Google Ireland Limited (YouTube, Ireland). The service providers also process data for their own purposes in accordance with their own privacy policies.

Joint controllership. With regard to the visitor statistics (Page Insights) for our Facebook page, we are joint controllers with Meta Platforms Ireland Limited (Dublin, Ireland). Meta has assumed primary responsibility for the processing of the statistics and for giving effect to data subjects’ rights. More information: Page Insights Controller Addendum, information about Page Insights data and Meta’s Privacy Policy.

With regard to the visitor statistics (Page Insights) for our LinkedIn page, we are joint controllers with LinkedIn Ireland Unlimited Company (Dublin, Ireland). LinkedIn is responsible for informing its members and for giving effect to data subjects’ rights. More information: Page Insights Joint Controller Addendum, LinkedIn’s Privacy Policy and LinkedIn’s Data Protection Officer contact form.

We receive only aggregated data from the visitor statistics and cannot see data about individual persons in them. You can exercise your rights against both us and the service provider concerned, but with regard to the statistics it is often most effective to address your request directly to the service provider. For our Instagram account and YouTube channel, we receive aggregated statistics produced by the services, and Meta and Google process the data in accordance with their own privacy policies.

4. Cookies and similar technologies

Cookies are small text files stored in your browser. We also use similar technologies, such as the browser’s local storage, tracking code and embedded external content. We divide cookies and technologies into strictly necessary, analytics and marketing categories. Analytics and marketing cookies and the related tracking code are switched off by default, and you can accept or reject them in the cookie banner shown on the website. The YouTube videos and Google Maps maps on our pages also load only after you have given your consent (Section 4.5).

4.1 Strictly necessary cookies

Strictly necessary cookies are needed for basic website functions that you have requested. They are used without consent.

Language selection: remembers the language version you have chosen.
Quote request basket: session cookies remember the products you have added to the basket so that you can put together a quote request. The lifetimes of the cookies are shown in the cookie list (Section 4.7).
Storing consent: the CookieScript service stores your cookie choices so that the website complies with them.

To manage consents, we use the CookieScript service, provided by Objectis, UAB (Lithuania) as a processor. To demonstrate consent, the service stores your choices in a cookie. When consent logging is enabled, the service also records the time of consent or its withdrawal, the page on which the choice was made, browser information and a truncated IP address. The service’s code is loaded from CookieScript’s servers, which means that your IP address is transmitted to the service provider. The legal basis for logging consent choices is our obligation to be able to demonstrate that consent has been obtained (Articles 6(1)(c) and 7(1)). The legal basis for loading the service’s code and the associated transmission of your IP address is our legitimate interest in managing consents reliably (Article 6(1)(f)). Consent data is kept for as long as necessary to demonstrate consent. More information: CookieScript’s privacy policy.

4.2 Google Tag Manager and Google Consent Mode

The tracking code on our website is loaded using Google Tag Manager. Google Tag Manager is provided by Google Ireland Limited (Ireland), which acts as our processor in this respect.

We use Google Consent Mode (v2). By default, all purposes that require consent are blocked until you make your choice. Before consent is given, Google’s tags neither store nor read analytics or advertising cookies. Google may, however, receive cookieless, non-identifying pings, such as the page address, browser type and a timestamp, for the purpose of measuring activity. Your IP address is technically transmitted to Google when the connection is established, but according to Google, Analytics does not log or store it. Once you give consent, the tags operate to the extent of the consent you have given.

Data: IP address, browser information, page address, referring page, timestamp and the status of your consent choices.
Purpose: central management of the website’s tracking code, applying your consent choices in the tags, and cookieless measurement of activity before consent.
Legal basis: our legitimate interest in managing the website’s tags centrally, ensuring that they comply with your consent choices, and obtaining cookieless information about how the website is functioning (Article 6(1)(f)).
Retention period: according to Google, request logs containing IP addresses are deleted within 14 days. Analytics data is kept as described in Section 4.3.
Recipients: Google Ireland Limited as our processor (Tag Manager and Analytics). Data sent by Google Ads tags is received by Google as an independent controller (Section 4.4). Recipients also include Google group companies, including in the United States (Section 7).

4.3 Analytics (with consent)

Google Analytics 4. We use Google Analytics 4 to understand how our website is used and to improve it. The service is provided by Google Ireland Limited (Ireland) as our processor.

Data: a random identifier stored in a cookie, pages viewed and the referring page, actions taken on the website (for example YouTube video viewing events), device and browser information, and approximate location inferred from the IP address.
Purpose: compiling statistics on website use and improving the website.
Legal basis: consent (Article 6(1)(a)).
Retention period: user-level and event-level data for a maximum of 14 months.
Recipients: Google Ireland Limited and Google group companies, including in the United States (Section 7).

We no longer use the old Universal Analytics service. You can also prevent the use of Google Analytics on all websites with Google’s browser add-on. More information: Google’s Privacy Policy and how Google uses information from sites that use its services.

The chat service (Section 3.3) also loads only after analytics consent has been given.

4.4 Marketing (with consent)

Google Ads conversion tracking. We measure the effectiveness of our Google Ads advertising using conversion tracking and the Conversion Linker function, which stores ad click information in cookies.

Data: ad click identifier, conversion events (for example sending a quote request) and their time, page address, referring page, browser information and IP address.
Purpose: measuring and improving the effectiveness of advertising.
Legal basis: consent (Article 6(1)(a)).
Retention period: cookie lifetimes are shown in the cookie list. Google retains the data it receives in accordance with its own privacy policy.
Recipients: Google Ireland Limited (Ireland), which processes the data as an independent controller, and Google group companies, including in the United States. More information: Google’s Privacy Policy and Google’s ad settings.

Meta Pixel and Conversions API. We use Meta’s advertising tools to measure and target our advertising shown on Facebook and Instagram. Event data is transmitted to Meta via the Tracklution service, both from the browser and through a server-to-server connection (Conversions API). Meta events require your marketing consent.

Data: event data, such as page views, adding a product to the quote request basket and chat service events, browser and device information, IP address and cookie identifiers.
Purpose: measuring the effectiveness of advertising, and targeting and optimising advertising.
Legal basis: consent (Article 6(1)(a)).
Retention period: cookie lifetimes are shown in the cookie list. Meta retains the data it receives in accordance with its own privacy policy.
Recipients: Tracklution Oy (Helsinki) as our processor; Meta Platforms Ireland Limited (Dublin, Ireland) and Meta Platforms, Inc. (United States).

We are joint controllers with Meta Platforms Ireland Limited with regard to the collection of the data and its transmission to Meta. After the transmission, Meta processes the data as an independent controller for its own purposes. The responsibilities of the parties are set out in Meta’s Controller Addendum. We are responsible for ensuring that our website provides information about the collection of data and its transmission to Meta, and that the processing is based on your consent. You can exercise your rights under the GDPR against both us and Meta (Article 26(3)). More information: Meta’s Controller Addendum, Meta’s Privacy Policy and Tracklution’s privacy policy.

4.5 YouTube and Google Maps embeds

Some of our pages contain embedded YouTube videos, and our contact pages contain an embedded Google Maps map. When an embed loads, your browser connects to Google’s servers. Google then receives, for example, your IP address and the address of the page you are visiting, and may set or read cookies. If you are signed in to your Google account, Google may link the data to your account. Google also processes the data for its own purposes, such as providing and developing its services, preventing misuse and advertising.

The embeds load only after you have given your consent: videos once you have accepted marketing cookies (Targeting) and the map once you have accepted functional cookies (Functionality) in the cookie settings. Until then, a placeholder is shown and no data is transmitted to Google. Videos are embedded in YouTube’s privacy-enhanced mode (youtube-nocookie.com). Some videos on our website are provided as links that open the video on YouTube in a new tab; in that case YouTube processes your data in accordance with its own privacy policy.

Data: IP address, the address of the page you are visiting, browser information, cookie identifiers, and data about video viewing and map use.
Purpose: presenting product videos and our location on the website.
Legal basis: consent (Article 6(1)(a)); for cookies and similar technologies, the provisions referred to in Section 4.7.
Retention period: the lifetimes of cookies detected on the website are shown in the cookie list (Section 4.7). Google retains the data it receives in accordance with its own privacy policy.
Recipient: Google Ireland Limited (Ireland) and Google group companies, including in the United States (Section 7). More information: Google’s Privacy Policy and how Google uses information from sites that use its services.

4.6 jsDelivr content delivery network

Our website loads some of its technical files, such as stylesheets and code libraries, from the jsDelivr content delivery network. When a file is loaded, your IP address, browser information, the referring page and the time are transmitted to the service provider. The service does not set cookies. jsDelivr is operated by Volentio JSD Limited (United Kingdom), and its content delivery partners include Cloudflare and Fastly (United States). jsDelivr also uses usage data for aggregated statistics. The legal basis is our legitimate interest in delivering the website quickly and reliably (Article 6(1)(f)). jsDelivr keeps usage data temporarily until it has been aggregated into statistics, after which the individual data is deleted. More information: jsDelivr’s privacy policy.

4.7 Legal bases and cookie list

We use strictly necessary cookies without consent because they are essential for providing the service you have requested. We use cookies and similar technologies other than strictly necessary ones, such as analytics and marketing cookies and embedded content, only with your consent. Consent is required in Finland by section 205 of the Act on Electronic Communications Services (917/2014), in Germany by § 25 TDDDG and in Sweden by Chapter 9, section 28 of lagen (2022:482) om elektronisk kommunikation. The legal basis for processing personal data on the basis of consent is Article 6(1)(a) GDPR.

The cookie list below shows the cookies used on the website, their providers, purposes and lifetimes. The list is updated automatically.

4.8 Changing and withdrawing consent

You can change your cookie choices or withdraw your consent at any time as easily as you gave it. Open the cookie settings using the button in the bottom left-hand corner of the website or the button below. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal (Article 7(3)).

Open cookie settings

You can also use your browser settings to delete cookies or prevent them from being stored. Please note that if you block strictly necessary cookies, features such as the quote request basket and language selection may not work.

5. Sources of personal data

We obtain personal data from the following sources:

directly from you, for example when you send a quote request, contact us, use the chat or deal with us as a customer, supplier or partner
from the company or organisation you represent
automatically from your browser and device when you use our website (server logs, cookies and similar technologies as described in Section 4)
from public sources, such as business registers, the media and company websites
from credit reference agencies in connection with credit checks on business customers
from social media services (aggregated statistics)

6. Recipients and processors

We use service providers that process data on our behalf as processors under contracts complying with Article 28 GDPR. In addition, some services receive data as independent controllers or joint controllers, as set out below. We may also disclose data to public authorities where required by law.

Processors

UpCloud – website server – UpCloud Oy, Finland
Wordfence Security – website security – Defiant, Inc., United States
Microsoft 365 – company email and messages sent by the website – Microsoft Ireland Operations Limited, Ireland
Pipedrive – sales customer relationship management – Pipedrive OÜ, Estonia
Lemonsoft – enterprise resource planning, customer relationship management and invoicing – Lemonsoft Oyj, Finland
Serviceform – chat, chatbot and chat contact forms – Serviceform Oy, Finland
Algolia – website search – Algolia SAS, France
CookieScript – cookie consent management – Objectis, UAB, Lithuania
Google Tag Manager and Google Analytics 4 – tag management and website analytics – Google Ireland Limited, Ireland
Tracklution – transmission of advertising events to Meta – Tracklution Oy, Finland
email marketing service provider – sending marketing messages

Independent controllers and joint controllers

Google Ads – advertising conversion tracking – Google Ireland Limited, Ireland (independent controller)
YouTube and Google Maps embeds – displaying videos and the map – Google Ireland Limited, Ireland (also processes data for its own purposes)
Meta Pixel and Conversions API – advertising measurement and targeting – Meta Platforms Ireland Limited, Ireland (joint controller for collection and transmission, thereafter independent controller)
Facebook page visitor statistics – Meta Platforms Ireland Limited, Ireland (joint controller)
LinkedIn page visitor statistics – LinkedIn Ireland Unlimited Company, Ireland (joint controller)
credit reference agencies – credit checks

Other recipients

jsDelivr – content delivery network – Volentio JSD Limited, United Kingdom (receives file request data and also uses it for aggregated statistics)

7. Transfers of data outside the EU and EEA

Some of our service providers or their sub-processors also process personal data outside the EU and the European Economic Area (EEA), in particular in the United States. We transfer data outside the EU and EEA only on the grounds set out in Chapter V of the GDPR.

United States, EU–US Data Privacy Framework: Google LLC, Meta Platforms, Inc., Microsoft Corporation and LinkedIn Corporation have committed to the EU–US Data Privacy Framework. Transfers to them are based on the European Commission’s adequacy decision (Article 45).
United Kingdom: transfers to the operator of the jsDelivr service are based on the European Commission’s adequacy decision for the United Kingdom (Article 45).
Other transfers: for other service providers and their sub-processors, such as those relating to the website search service, the customer relationship management system, the chat service, the transmission of advertising events, the security service, the content delivery network partners and the server infrastructure of the consent tool, transfers are based on the standard contractual clauses approved by the European Commission or on other appropriate safeguards under Article 46 GDPR, as applied by the service provider.

You can ask our Data Protection Officer for more information about the safeguards used and a copy of them (for example, the standard contractual clauses).

8. Retention periods

We keep personal data only for as long as necessary for the purposes for which it was collected, or for as long as required by law. Summary:

Quote requests and enquiries: for as long as necessary to handle the request and manage any customer relationship, after which the data is deleted or anonymised.
Customer, supplier and partner data: for the duration of the relationship and thereafter for as long as the data is needed to meet obligations and deal with any claims.
Accounting records: in accordance with Chapter 2, section 10 of the Accounting Act, financial statements and books of account for 10 years from the end of the financial year, and vouchers and correspondence concerning business transactions for 6 years from the end of the year in which the financial year ended.
Credit information: for as long as necessary for the credit decision and managing the customer relationship.
Marketing: until you object to the processing or withdraw your consent; a marketing opt-out is kept so that it can be complied with.
Server and security logs: for as long as necessary to ensure information security and investigate misuse.
Website search (Algolia): search request logs for 90 days under the service’s default settings.
Google Analytics 4: user-level and event-level data for a maximum of 14 months.
Content delivery network (jsDelivr): usage data temporarily until it has been aggregated into statistics.
Cookies: the lifetime of each cookie is shown in the cookie list in Section 4.7.
Consent data: for as long as necessary to demonstrate consent.

9. Your rights

Under the GDPR, you have the following rights:

Right of access (Article 15): you can obtain confirmation as to whether we process your data and a copy of your data.
Right to rectification (Article 16): you can ask us to correct inaccurate data or complete incomplete data.
Right to erasure (Article 17): you can ask us to erase your data, for example where it is no longer needed or where you withdraw your consent, unless we are required by law to keep it.
Right to restriction of processing (Article 18): you can ask us to restrict processing, for example while the accuracy of the data is being verified.
Right to data portability (Article 20): you can receive the data you have provided in a structured, commonly used and machine-readable format where the processing is based on consent or a contract and is carried out by automated means.
Right to withdraw consent (Article 7(3)): you can withdraw your consent at any time. For cookies, this can be done as explained in Section 4.8.

How to exercise your rights. Send your request by post to TSR-ELSITE Oy, Orikedonkatu 17, 20380 Turku, Finland, or by email to our Data Protection Officer at jarno.salonen@tsr-elsite.fi. The request does not need to be signed. We will ask for additional information to confirm your identity only where necessary (Article 12(6)). Handling requests is, as a rule, free of charge.

We will respond to your request without undue delay and at the latest within one month of receiving it. If requests are numerous or complex, this period may be extended by up to two further months, in which case we will inform you of the extension and the reasons for it within one month (Article 12(3)).

10. Right to object to processing

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data that is based on our legitimate interest (Article 21(1) GDPR, Article 6(1)(f)). In that case, we will stop the processing unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

You have the right to object at any time to the processing of your personal data for direct marketing purposes (Article 21(2)). If you object, we will stop processing your data for this purpose.

You can exercise your right to object by notifying us by post to TSR-ELSITE Oy, Orikedonkatu 17, 20380 Turku, Finland, or by email at jarno.salonen@tsr-elsite.fi. You can also stop receiving marketing emails by using the link at the end of the message. You can block consent-based cookies in the cookie settings (Section 4.8).

11. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes data protection legislation (Article 77). In Finland, the supervisory authority is the Office of the Data Protection Ombudsman:

Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address: PO Box 800, 00531 Helsinki, Finland
Email: tietosuoja@om.fi
Switchboard: +358 29 566 6700
Website: tietosuoja.fi

You can also lodge a complaint with the supervisory authority of the EU or EEA member state in which you habitually reside or work or in which the alleged infringement took place. In Germany, the supervisory authority is usually the data protection authority of your federal state, and a list of the federal state authorities is available on the website of the German Federal Commissioner for Data Protection and Freedom of Information. In Sweden, the supervisory authority is Integritetsskyddsmyndigheten (IMY).

In Finland, compliance with section 205 of the Act on Electronic Communications Services, which concerns cookie consent, is supervised by the Finnish Transport and Communications Agency, Traficom.

12. Is providing data mandatory?

Providing personal data to us is voluntary. In the quote request basket, the only mandatory information is your email address, without which we cannot respond to your quote request. When we enter into a contract with you or the company you represent, we need the data required to manage the contract and to invoice, and some of the data must be kept under the Accounting Act. If you do not provide this data, we may not be able to enter into a contract or deliver an order. Accepting cookies other than strictly necessary cookies is voluntary, and refusing them does not prevent basic use of the website. However, the chat service is only available if you have accepted analytics cookies; you can always also contact us by email or telephone.

13. Automated decision-making

We do not make decisions based solely on automated processing of your personal data that would produce legal effects concerning you or similarly significantly affect you (Article 22).

14. Data security

We protect personal data with appropriate technical and organisational measures (Article 32). Our website runs in a data centre located in Helsinki and is protected by a firewall and login protection. Access to personal data is restricted to those persons who need the data in their work. Our service providers process data on our behalf only in accordance with contracts and our instructions, and they have undertaken to ensure that the data is protected. If we detect a personal data breach, we will act as required by the GDPR.

15. Changes to this privacy notice

We update this privacy notice when our processing activities, the services we use or legislation change, for example if we introduce a new chat service. The date at the beginning of the notice shows when it was last updated.